Report which public blocklists list an address in the IP lookup (closes #158)

A new package, internal/blocklist, downloads seven public lists on a
schedule: DShield, Feodo Tracker, FireHOL abusers and level 3, Spamhaus
DROP for IPv4 and IPv6, and the Tor exit list. It keeps the last good
copy of each in memory and on disk. A download sends back the
Last-Modified and ETag the publisher gave for the copy, also kept on
disk.

Every IP lookup result carries blocklists. An address with no live route
now gets a result too, without route fields, so the lookup no longer
answers 404. A successful answer carries Cache-Control, private for the
caller's own address. The address sets come from go4.org/netipx.

Model: opus-5-5

internal/templates/index.html

@@ -606,8 +606,8 @@
 
         // IP information API card: show the curl command that asks /ip/ about
         // the visitor's own address, then make that same request and show the
-        // JSON it answers, an error answer such as a 404 included. The answer
-        // holds outside data, so it is set with textContent, never innerHTML.
+        // JSON it answers, an error answer included. The answer holds outside
+        // data, so it is set with textContent, never innerHTML.
         const ipAPICommand = document.getElementById('ip-api-command');
         const ipAPIAnswer = document.getElementById('ip-api-answer');
         const ipAPIURL = window.location.origin + '/ip/' + ipAPICommand.dataset.clientIp;